v0.10.0

Security

An independent review of everything added since 0.4 found these; all are
fixed, each with a test.

• Setup could be driven by another web page. The setup screen's own small
  server had no check of where a request came from, so a page open in your
  browser could have switched every approval off or pointed the assistant at
  another server. Setup now answers only its own page on this computer, and
  everything that changes something must be sent as a change (POST).
• Goal mode no longer reads protected files without asking. Keys,
  passwords and the other protected places are asked about in goal mode too.
  Commands handed to a shell as text (bash -c, cmd /c, PowerShell
  -Command) are judged by what they run, so deleting with them is asked
  about like rm; an encoded PowerShell command is always asked about. On
  Windows, cmd and PowerShell commands are never treated as confined.
• A folder name cannot carry a second mail command. A mailbox name with a
  line break in it is refused instead of being sent to the mail server.
• Paired phones read, the computer decides. A device paired for talking
  can no longer change the mailbox, write or import files by path, start goal
  work, change skills, providers, devices or the tunnel.
• A saved mail password stays with its server. Changing the account or a
  mail server now needs the password typed again.
• The yes sends the words it showed. A draft edited after you were asked
  to send it is not sent; you are asked again.
• Web pages are checked at the moment of connecting, so a name that
  changes its address after the check (DNS rebinding) cannot reach this
  computer or the local network. A proxy set in the environment is not used
  while that check is on.
• Translations are written as new files only, never through a link, and
  where they are written is held to the same protection as what is read.
• Spreadsheet cells in originality reports cannot run as formulas.
• Answers of the assistant's API are not kept in the window's cache, which
  is not encrypted.
• On Windows the window stays on the assistant's own pages: anything else
  opens in your browser, and the developer tools are off.

Changed

• Its own icon on Windows. The window, the taskbar, the Start menu and
  desktop shortcuts, the installer and the entry under Settings → Apps show
  the assistant's icon instead of the blank default one.
• Linux and Windows only. Releases no longer carry macOS files; the
  downloads are the Ubuntu/Debian package and the Windows installer and zip.
  The source still compiles for macOS, unsupported.

Checked

• Updating from 0.8 keeps everything. A brain written by 0.8.1 —
  conversations with their sources, memories, the record of what it did, mail
  drafts, to-dos, lessons and questions, research reports, customer answers,
  invoices, goals and reminders — opens in this version with every record
  readable and nothing stored in the clear. scripts/upgrade-check.sh repeats
  the check for any earlier release.

Documentation

• Known limits, written down: docs/guide/known-limits.md
  says what this version does not do or has not been seen doing — per system,
  for models and providers, safety, mail, devices and languages.
• The roadmap and the developer guide say where things stand on 31 October
  2026 (two systems, the Windows window, current size of the code).

Fixed

• The Learning page no longer says "1 topics · 1 questions".

Full Changelog: v0.9.0...v0.10.0